Enterprise Risk Management (ERM) Manager

University-Corporation-For-Atmospheric-Research; Export (PA); Hybrid; USD 113,000 - 142,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Retirement plan

Paid time off

Tuition assistance

Employee assistance program

Job summary

The University Corporation for Atmospheric Research (UCAR) seeks an Enterprise Risk Management (ERM) Manager to shape and mature our risk strategy. You will lead risk assessment, incident response, business continuity, and corporate compliance in a cross-functional, collaborative environment.

You’ll partner with RAC and organizational leaders to build risk culture, develop tools and dashboards, and drive proactive resilience across UCAR.

Qualifications

• Master’s degree in business or related field or an equivalent combination of education and experience.
• Minimum 5 years of enterprise risk management experience.
• Experience leading incident response efforts and cross-functional coordination.
• Knowledge of business continuity principles and planning methodologies.

Responsibilities

• Lead risk assessment and mitigation efforts across the organization.
• Oversee incident response management and after-action assessments.
• Develop and maintain business continuity framework and plans.
• Ensure corporate compliance and cross-functional coordination.

Skills

Risk management

Incident response

Business continuity

Cross-functional leadership

Communication

Education

Master’s degree in business or related operational management

5 years of comparable experience

Tools

ISO 22301

ISO 31000

NIST SP 800-37

NFPA standards

Job description

Position Type:RegularVisa Sponsored Job:NoRelocation Assistance Eligible:NoHiring Range:113,470.00 USD - 141,840.00 USD*Final salary and rates are based on education, experience, and skills relevant to the role.Application Closes at 11:59 pm Mountain Time on:2026-11-12About The RoleWe are seeking a dynamic, forward-thinking Enterprise Risk Management (ERM) Manager to lead, reshape, and mature our organizational risk strategy.This isn't just a corporate oversight role—it is an active, cross-functional leadership position.This role will serve as the strategist and operational catalyst behind four essential pillars:1) Risk assessment and mitigation2) Incident response and recovery3) Business continuity4) Corporate compliance.To carry out these responsibilities, the ERM Manager will work closely with employees in the Risk, Assurance, and Compliance (RAC) team and across the organization.US Person required: To qualify, the incumbent must be (a) a U.S. citizen; (b) lawfully admitted for permanent residence in the United States; or (c) a protected individual as defined by 8 USC1324b(a)(3).Job DescriptionKey Responsibilities:Risk Assessment and MitigationConduct periodic internal risk assessments, in coordination with the Director of RAC and Internal Audit, to identify, prioritize, and document key risks.Recommend risk mitigation and control measures to leadership and provide assistance as appropriate.Perform periodic external risk horizon scans, monitor emerging risks, and advise executive leadership as needed.Build, advance, and use tools, scorecards, and dashboards to accurately track and report risks for RAC and leadership awareness, enabling timely, well-informed decisions.Lead short- and long-term risk mitigation efforts, as assigned by the COO or Director of RAC, based on organizational needs.Act as internal advisor to departments, as requested, on risk mitigation and/or operational resilience.Facilitate cross-functional risk assessments between departments that consider interdependencies, internal and external factors, and both existing and emerging risks.Work with leadership to define organizational risk appetite, build a stronger risk culture, and shift the entire organization’s mindset from reactive to proactive.Incident Response and RecoveryOversee and coordinate incident response management during organizational critical events, working with subject matter experts and leadership on immediate, tactical responses and decision-making.Provide after-action assessments and incident response reviews for continuous improvement.Partner with UCAR Communications to ensure accurate, timely, and strategic messaging throughout all stages of incident response and recovery.Enhance capabilities and maintain readiness with UCAR response plans and incident response resources.Oversee UCAR’s incident response program through planning, training, and exercises.Integrate incident response team plans with LCPO tactical response plans (e.g., cyber response, aviation incidents).Develop executive summaries and technical briefings for leadership, legal counsel, and insurance partners to understand and document the incident after the fact.Business ContinuityManage business continuity activities to develop a coherent, integrated business continuity program across the organization.Champion and foster senior leadership support for business continuity.Develop and maintain the framework, processes, and procedures departments follow when establishing business continuity plans for their operations.Coach department representatives through completing business impact analyses, risk assessments, gap analyses, recovery strategy development, and business continuity plan writing.Develop and manage a program that ensures business continuity plans are regularly exercised, reviewed, updated, and adequately integrated.Corporate CompliancePartner with the Director of RAC and work with stakeholders organization-wide to:Establish and monitor key compliance requirements and their status across the organization.Research compliance requirements for new organizational initiatives.Periodically report on organizational compliance status to leadership.Administrative ActivitiesComplete all required professional development, including goal-setting, training, and participation in periodic performance reviews.Manage the enterprise risk management budget, spending, and requests for incremental increases, including participation in routine budget planning and reconciliation activities.Education & Experience REQUIRED:Master’s degree in business or related operational management orFive (5) years of comparable experienceGeneral experience performing enterprise risk management responsibilities, such as risk assessment, mitigation planning, and risk reporting.Demonstrated experience leading incident response efforts, including coordinating cross-functional teams and subject matter experts during critical events.Working knowledge of business continuity principles, frameworks, and planning methodologies (e.g., business impact analysis, recovery strategy development).Experience working effectively within matrixed organizations.Knowledge, Skills, and Abilities REQUIRED:Knowledge of quantitative and qualitative data collection and analysis methods.Knowledge of risk-related standards such as ISO 22301, ISO 31000, NFPA standards on emergency response, the Incident Command System, NIST 800-37, or similar.Project management experience and skills.Ability to respect and bring together diverse perspectives and needs and build high-performance teamsExcellent verbal and written communication skills, equally effective with large and small audiences, one-on-one, and across a wide range of constituencies.Ability to handle confidential and sensitive matters with discretion.Demonstrated leadership and complex organizational management skills.Ability to achieve results in a complex environment.Demonstrate a continuous improvement mindset, collaborating cross-functionally to create tools, resources, capabilities, and/or processes that improve outcomes.Preferred QualificationsDesired but Not Required:Previous experience involving risk management in a Federally Funded Research and Development Center (FFRDC) or similar environment.Understanding of commercial insurance lines and how they interact with an organization's overall risk appetiteProfessional certification from RIMS, Disaster Recovery Institute International, the Business Continuity Institute, or similar.Application RequirementsQuestionnaire, Resume/CVSubmit all required application materials by 11:59 p.m. Mountain Time on the deadline. Only candidates with complete applications (including questionnaires, when required) will be considered.We recognize that no candidate will meet 100% of the listed qualifications. If you believe your background has prepared you for success in this role, we encourage you to apply.Candidates selected for hire will complete background checks and/or federal screenings.Benefits OverviewUCAR offers a comprehensive benefits package: health insurance, dental, retirement plan, leave plans, tuition assistance, and employee assistance programs:Medical, Dental, Vision, and Short & Long Term Disability InsuranceGenerous retirement plan - UCAR contributes of 10% of base salaryTime Off PlansMinimum 20 days of annual PTO10 paid holidays12 weeks of paid parental leaveFAMLI LeaveTuition Assistance ProgramPublic Service Loan Forgiveness (PSLF) eligible employerAdditional InformationUCAR is an Equal Opportunity Employer and welcomes all applicants. We do not discriminate based on race, age, sex, gender identity, disability, veteran status, or any other legally protected characteristic. You don’t need to include age-related information, such as birth or graduation dates, in your initial application.Applicants with disabilities may be entitled to reasonable accommodation under the Americans with Disabilities Act, the Colorado Anti-Discrimination Act, or local laws. A reasonable accommodation is a change in the way things are normally done which will ensure an equal employment opportunity without imposing undue hardship on an employee. Please inform your Recruiter if you need assistance completing this application or to otherwise participate in the application process.Visa Sponsorship: UCAR can sponsor H-1B status only for candidates already in the U.S. who hold H-1B status or another status that allows a change to H-1B within the country. We cannot sponsor new H-1B visas that require consular processing abroad.Compliance and Location: All roles must comply with U.S. export control regulations and work location requirements. Hybrid staff work on-site 3 days per week or equivalent, based on their flexible work arrangement. UCAR requires ALL positions to be performed within the U.S., excluding U.S. Territories.Artificial Intelligence (AI) Use: AI tools are permitted, but we strongly encourage candidates to submit primarily original work.